Skip to content

v0.0.7

Latest
Latest

Choose a tag to compare

View all tags
@tsmztech tsmztech released this 09 Aug 18:44
v0.0.7
98e2ad5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is the first GitHub release for this project. Earlier versions (0.0.1 to 0.0.6) were published to npm only.

New features

  • Access Token authentication (#115, thanks @hansn74): connect with an existing session token by setting SALESFORCE_CONNECTION_TYPE=Access_Token together with SALESFORCE_ACCESS_TOKEN and SALESFORCE_INSTANCE_URL. Useful when a token is already issued by an external flow.
  • Configurable API version (#120): the optional SALESFORCE_API_VERSION environment variable (for example 62.0) selects the Salesforce API version instead of the jsforce default.
  • Docker support (#132, thanks @gaoharimran29-glitch): a production Dockerfile (Node 22 slim, non-root user, lockfile-based install) for running the server in a container.
  • Read-only tool annotations (#141, thanks @FutureEnterprises): the 7 read-only tools (search_objects, describe_object, query_records, aggregate_query, search_all, read_apex, read_apex_trigger) now declare the MCP readOnlyHint: true annotation, so clients can treat them as safe, non-mutating operations.

Fixes and improvements

  • The server now reports its real package version to MCP clients; it previously always reported a hardcoded 1.0.0
  • Removed the non-standard optional keyword from tool input schemas; it broke clients with strict JSON Schema validation (#119)
  • Clear startup warning when the server is run under Bun, which is not a supported runtime (#121)
  • npm package metadata now includes repository, bugs, and homepage links (#116)
  • package-lock.json is committed, making installs, CI, and the Docker image reproducible (#133)

Security

  • Patched 4 transitive dependency vulnerabilities via in-range lockfile updates: fast-uri 3.1.5, ip-address 10.4.0, hono 4.13.1, @hono/node-server 2.1.0. All were in the MCP SDK HTTP transport stack, which this stdio-only server does not use, but the tree is now clean (npm audit: 0 vulnerabilities).

Dependencies and toolchain

  • MCP SDK 1.22.0 to 1.30.0, including a protective 10MB limit on incoming stdio messages
  • dotenv 16.6.1 (verified stdout-safe for MCP stdio transport)
  • TypeScript 7.0.2 build toolchain (runtime output verified byte-identical to 5.9.3)
  • CI security hardening: all GitHub Actions workflow dependencies updated and SHA-pinned (CodeQL 4.37.3, Scorecard 2.4.4, harden-runner 2.20.1)

Install: npx -y @tsmztech/mcp-server-salesforce or npm install @tsmztech/mcp-server-salesforce

Full changelog: aafd12d...v0.0.7

Contributors

hansn74, gaoharimran29-glitch, and FutureEnterprises
Assets 2
Loading